AI law watch
CTSince October 1, 2026, using an AI hiring tool is no longer a defense in ConnecticutCOColorado repealed its AI Act — the ADMT law replacing it starts January 1, 2027CACalifornia's ADMT rules under the CCPA carry that same January 1, 2027 dateTXTexas TRAIGA has been in force since January 1, 2026 — penalties reach $200,000HIHawaiʻi's two AI acts took effect on approval, July 14, 2026ILIllinois's AI-in-employment rules have applied since January 1, 2026 — frontier-model audits start January 1, 2028US1,561 state AI bills introduced in 2026 — see which states you need to care aboutCANCanada has no AI Act — but Québec's automated-decision law has applied since September 2023
Build your plan
Start with AI Governance. Add what you need.
Every plan is built on the AI Governance module. Your tier sets the depth, and you switch on the management modules — Risk, IT, Data — as you need them. Flat pricing per tier, never per seat.
One flat price for your organization · never per seat · 20% off for nonprofits
Starter
For the org standing up its first AI governance program
$3,500/yr
billed annually, or $339/mo billed monthly
🏛️ Nonprofit: $2,800/yr
AI Governance plus one management module — a real program in place.
- ✓ NIST AI RMF + ISO 42001 crosswalks
- ✓ Every U.S. state law, added as they pass States covered todayAlabama · Arizona · California · Colorado · Connecticut · Delaware · Florida · Georgia · Hawaii · Idaho · Illinois · Indiana · Iowa · Kansas · Kentucky · Louisiana · Maine · Maryland · Minnesota · Montana · Nebraska · Nevada · New Hampshire · New Jersey · New York · North Dakota · Oklahoma · Oregon · Rhode Island · South Carolina · Tennessee · Texas · Utah · Vermont · Virginia · Washington · Wisconsin · Wyoming
- ✓ Plus specific statutes from 27 states via the U.S. state law landscape
- ✓ United States — federal law & state landscape (U.S. National)
- ✓ Grounded policy generation — every clause cites a control · Patent pending
- ✓ Risk register, impact assessments, incident log
- ✓ Privacy program, privacy impact assessments and a Privacy Policy
- ✓ Vendor and AI System registries — approval status, terms on file
- ✓ Shadow AI Discovery
- ✓ Approval gate for use cases; staff AI-tool reporting link
- ✓ Cost tracking with 60-day renewal alerts
- ✓ Board report, governance badge, Trust Page
- ✓ Unlimited staff participants and attestations
- ✓ AI Training & Certification — all 7 AI Leadership Course credentials
- ✓ REST API (read)
- ✓ Pay by card or ACH bank transfer
- ✓ 10 admin seats
ProMost popular
For growing programs with privacy obligations
$12,000/yr
billed annually — equates to $1,000 per month
🏛️ Nonprofit: $9,600/yr
- ✓ Everything in Starter, plus:
- ✓ ISO/IEC 42005 impact assessments
- ✓ Cybersecurity — NIST SP 800-53 Rev. 5, NIST CSF 2.0 and SOC 2, each with its own crosswalk
- ✓ CCPA and every U.S. state privacy law
- ✓ Financial and insurance regulation — NY DFS Part 500 and the NAIC data security model law
- ✓ NAIC Bulletin Review/Crosswalk
- ✓ Canada's AI laws and guidance
- ✓ AI standards and healthcare AI guidelines
- ✓ Risk heat map
- ✓ Assessments auto-populate the risk register
- ✓ AI Strategic Plan and CAIO wizards
- ✓ CCPA privacy paperwork — processor agreements, notices and consent, privacy requests
- ✓ Branded document exports
- ✓ Shadow AI Discovery+
- ✓ Vendor questionnaires answered through a private vendor portal
- ✓ REST API (read + write) and signed outbound webhooks
- ✓ AI Agent Analysis
- ✓ Pay by card or ACH bank transfer
- ✓ 15 admin seats
Agency / Enterprise
For public agencies and regulated organizations
$25,000/yr
starting at, billed annually — always all four core modules + full Privacy
🏛️ Nonprofit: $20,000/yr
Buy the plan online, or get a written quote for a custom setup.
- ✓ Everything in Pro, plus the EU AI Act framework
- ✓ HIPAA and GDPR data-privacy frameworks
- ✓ Europe — EU regulation, Italy, UK, Switzerland, Norway
- ✓ Global — Americas, Middle East, Asia-Pacific, Central Asia & international (20 further countries + the international instruments) Countries covered todayArgentina · Australia · Brazil · China · Colombia · India · Indonesia · Israel · Japan · Kazakhstan · Mexico · Peru · Saudi Arabia · Singapore · South Korea · Taiwan · Thailand · Turkey · United Arab Emirates · Vietnam
- ✓ OMB M-25-21 / M-25-22 compliance pack
- ✓ Zero-trust agent checklist and scoring
- ✓ White-labeled Trust Page & badge, and Enterprise SSO
- ✓ Priority support and an advisory session
- ✓ Pay by card or ACH bank transfer
- ✓ 20 admin seats
Every plan includes AI Governance, multi-tenant security and an append-only audit log. Nonprofits save 20% on every plan: enter NONPROFIT20 at checkout. Not legal advice.
Creating an account takes a work email and no card. Every plan bills by card or U.S. bank account (ACH) through Stripe, and you can cancel any time; your plan runs to the end of the period you paid for. Billing terms →
Want someone alongside you? GOVERNBOX.ai Advisory Services → publishes a fee for every engagement — working sessions, half-day module training, a guided program launch — so you never need a call to learn a number.
Comparing tools? See GOVERNBOX vs OneTrust and GOVERNBOX vs Credo AI, side by side.
Buying for a government agency? We’re registered in SAM.gov, and most plans fit on a purchase card. How agencies buy →
See the full plan comparison
Full Plan Comparison
| Feature | Starter | Pro Most Popular | Agency / Enterprise |
|---|---|---|---|
| Core Platform | |||
| AI Readiness Scorecard | ✓ | ✓ | ✓ |
| AI Use Case Log (inventory + named owner per system) | Unlimited | Unlimited | Unlimited |
| Grounded document generation — every clause cites a reviewed control · Patent pending | ✓ | ✓ | ✓ |
| EU AI Act risk tier classification + Art. 5 prohibited-use screen | — | — | ✓ |
| Dashboard — My Workspace | ✓ | ✓ | ✓ |
| Notifications center (review countdowns, alerts) | ✓ | ✓ | ✓ |
| Append-only audit log | ✓ | ✓ | ✓ |
| Multi-tenant security + row-level isolation | ✓ | ✓ | ✓ |
| Document Generation | |||
| AI Use Policy | ✓ | ✓ | ✓ |
| AI Acceptable Use Standard | ✓ | ✓ | ✓ |
| AI Incident Response Plan | ✓ | ✓ | ✓ |
| Vendor AI Risk Assessment | ✓ | ✓ | ✓ |
| AI Strategic Plan (wizard) | — | ✓ | ✓ |
| CAIO Position Statement (wizard) | — | ✓ | ✓ |
| AI Committee Charter (wizard) | ✓ | ✓ | ✓ |
| Privacy Policy (consumer / data-subject rights) | NIST Privacy Framework | NIST Privacy Framework + CCPA | NIST Privacy Framework + GDPR + CCPA |
| OMB AI Compliance Plan (M-25-21 / M-25-22) | — | — | ✓ |
| Compliance Crosswalk export — five shelves: Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global | NIST + ISO 42001 + U.S. States + U.S. National | + ISO 42005 + SOC 2 + CCPA + Canada + AI Standards | + EU AI Act + GDPR + Europe + Global |
| Word (.docx) export | ✓ | ✓ | ✓ |
| PDF export | ✓ | ✓ | ✓ |
| Organization logo on document exports | — | ✓ | ✓ |
| Compliance Frameworks | |||
| NIST AI RMF | ✓ | ✓ | ✓ |
| ISO/IEC 42001 | ✓ | ✓ | ✓ |
| U.S. State AI Laws — all states, added as they pass | ✓ | ✓ | ✓ |
| · Colorado ADMT Act (SB 26-189) — eff. January 1, 2027 | ✓ | ✓ | ✓ |
| · Colorado Chatbot Safety (HB 26-1263) — eff. January 1, 2027 | ✓ | ✓ | ✓ |
| · Connecticut SB 5 (PA 26-15) | ✓ | ✓ | ✓ |
| · Texas TRAIGA — eff. January 1, 2026 | ✓ | ✓ | ✓ |
| · California ADMT Regulations — eff. January 1, 2027 | ✓ | ✓ | ✓ |
| · Hawaii AI Acts (247 / 248) | ✓ | ✓ | ✓ |
| · Alabama AI laws | ✓ | ✓ | ✓ |
| · Arizona AI laws | ✓ | ✓ | ✓ |
| · California AI laws (other statutes) | ✓ | ✓ | ✓ |
| · Colorado AI laws (other statutes) | ✓ | ✓ | ✓ |
| · Connecticut AI laws (other statutes) | ✓ | ✓ | ✓ |
| · Delaware AI laws | ✓ | ✓ | ✓ |
| · Florida AI laws | ✓ | ✓ | ✓ |
| · Georgia AI laws | ✓ | ✓ | ✓ |
| · Idaho AI laws | ✓ | ✓ | ✓ |
| · Illinois AI law & guidance — eff. January 1, 2027 | ✓ | ✓ | ✓ |
| · Indiana AI laws | ✓ | ✓ | ✓ |
| · Iowa AI laws | ✓ | ✓ | ✓ |
| · Kansas AI laws | ✓ | ✓ | ✓ |
| · Kentucky AI laws | ✓ | ✓ | ✓ |
| · Louisiana AI laws | ✓ | ✓ | ✓ |
| · Maine AI laws | ✓ | ✓ | ✓ |
| · Maryland AI laws | ✓ | ✓ | ✓ |
| · Minnesota AI laws | ✓ | ✓ | ✓ |
| · Montana AI laws | ✓ | ✓ | ✓ |
| · Nebraska AI laws | ✓ | ✓ | ✓ |
| · Nevada AI laws | ✓ | ✓ | ✓ |
| · New Hampshire AI laws | ✓ | ✓ | ✓ |
| · New Jersey AI laws | ✓ | ✓ | ✓ |
| · New York AI laws | ✓ | ✓ | ✓ |
| · North Dakota AI laws | ✓ | ✓ | ✓ |
| · Oklahoma AI laws | ✓ | ✓ | ✓ |
| · Oregon AI laws | ✓ | ✓ | ✓ |
| · Rhode Island AI laws | ✓ | ✓ | ✓ |
| · South Carolina AI laws | ✓ | ✓ | ✓ |
| · Tennessee AI laws | ✓ | ✓ | ✓ |
| · Texas AI laws (other statutes) | ✓ | ✓ | ✓ |
| · Utah AI laws | ✓ | ✓ | ✓ |
| · Vermont AI laws | ✓ | ✓ | ✓ |
| · Virginia AI laws | ✓ | ✓ | ✓ |
| · Washington AI laws | ✓ | ✓ | ✓ |
| · Wisconsin AI laws | ✓ | ✓ | ✓ |
| · Wyoming AI laws | ✓ | ✓ | ✓ |
| · U.S. state law landscape — specific statutes from 27 states | ✓ | ✓ | ✓ |
| EU AI Act | — | — | ✓ |
| ISO/IEC 42005 (AI impact assessment) | — | ✓ | ✓ |
| SOC 2 Trust Services Criteria (AI controls mapped into your SOC 2 program) | — | ✓ | ✓ |
| NIST SP 800-53 Rev. 5 and NIST CSF 2.0 (cybersecurity, each with its own crosswalk) | — | ✓ | ✓ |
| CCPA / CPRA privacy statute (California) | — | ✓ | ✓ |
| GDPR (EU data protection) | — | — | ✓ |
| HIPAA Security & Privacy Rules | — | — | ✓ |
| OMB M-25-21 / M-25-22 (Federal AI) | — | — | ✓ |
| Regulatory Jurisdictions — enabled as one unit on the Organization Profile | |||
| United States — federal law & state landscape — 2 frameworks, enabled as one unit | ✓ | ✓ | ✓ |
| Canada — 1 framework, enabled as one unit | — | ✓ | ✓ |
| AI frameworks, standards & healthcare guidelines — 2 frameworks, enabled as one unit | — | ✓ | ✓ |
| Europe — EU regulation, Italy, UK, Switzerland, Norway — 5 frameworks, enabled as one unit | — | — | ✓ |
| Global — Americas, Middle East, Asia-Pacific, Central Asia & international — 21 frameworks, enabled as one unit | — | — | ✓ |
| Risk & Impact | |||
| Risk Register (CRUD + likelihood × impact scoring) | ✓ | ✓ | ✓ |
| Risk heat map visualization | — | ✓ | ✓ |
| AI Impact Assessment (7-section questionnaire) | ✓ | ✓ | ✓ |
| Auto-create risk entries from assessments | — | ✓ | ✓ |
| AI Project Management Module | |||
| AI project list & per-project board | Up to 2 | Up to 5 | Unlimited |
| 7-phase AI development lifecycle checklist | ✓ | ✓ | ✓ |
| 45-item NIST/ISO/EU grounded task checklist | ✓ | ✓ | ✓ |
| Kanban board (drag-drop, task detail, Edit mode) | ✓ | ✓ | ✓ |
| Cross-links: Use Cases / Projects / Risk Register | ✓ | ✓ | ✓ |
| Agentic AI Governance Module | |||
| AI Agents inventory — basic registration (identity, ownership, data access) | ✓ | ✓ | ✓ |
| 12-item zero-trust controls checklist (NIST SP 800-207) | — | — | ✓ |
| Zero-trust score + low-score alerts | — | — | ✓ |
| Agent registration wizard (3-step) | ✓ | ✓ | ✓ |
| Agent metrics in Board Report governance block | ✓ | ✓ | ✓ |
| Cross-links: Agents / Use Cases / Risk Register | ✓ | ✓ | ✓ |
| Training, Incidents & Operations | |||
| Training plan + completion tracking | ✓ | ✓ | ✓ |
| Acceptable-use acknowledgment sign-off | ✓ | ✓ | ✓ |
| Incident log + severity codes | ✓ | ✓ | ✓ |
| EU AI Act Art. 73 serious-incident flag | — | — | ✓ |
| Reporting & Governance | |||
| Quarterly Board Report (full — maturity score + quarterly history) | ✓ | ✓ | ✓ |
| AI Cost Tracking & Roll-Up (per use case + program office, 60-day renewal alerts, Board Report totals) | ✓ | ✓ | ✓ |
| Board Report — AI Agents governance section | ✓ | ✓ | ✓ |
| Governance maturity score + stars (dashboard/badge) | ✓ | ✓ | ✓ |
| Shareable governance badge | ✓ | ✓ | ✓ White-labeled |
| Live public Trust Page + embeddable live badge | ✓ | ✓ | ✓ White-labeled |
| Employee Attestation Portal (unlimited signers) | ✓ | ✓ | ✓ |
| Regulatory horizon feed ("What's Changing") · Patent pending | ✓ | ✓ | ✓ |
| Gap report with advisory CTAs | ✓ | ✓ | ✓ |
| Integrations & API | |||
| Vendor registry — approval lifecycle, terms on file, backfill from your records | ✓ | ✓ | ✓ |
| AI System registry — model, vendor, hosting, training-data notes | ✓ | ✓ | ✓ |
| REST API with scoped keys (every change audited as the key) | Read | Read + write | Read + write |
| Outbound webhooks — HMAC-signed, retried for up to a day | — | ✓ | ✓ |
| Intake connector — Zapier, Jira, ServiceNow, email or any webhook | — | ✓ | ✓ |
| Shadow AI Discovery — browser extension shows which AI tools staff use | ✓ | ✓ | ✓ |
| Shadow AI Discovery+ — Okta / Google Workspace / Entra / Netskope / Zscaler / Cloudflare One imports | — | ✓ | ✓ |
| Vendor questionnaires answered through a private vendor portal | — | ✓ | ✓ |
| Use-case approval gate — an Admin signs off before a use case goes active | ✓ | ✓ | ✓ |
| Interactive API reference (OpenAPI) | ✓ | ✓ | ✓ |
| Administration | |||
| Admin Console (full data inventory & controls) | Owner + Admin | Owner + Admin | Owner + Admin |
| User roles (Owner / Admin / Member) | ✓ | ✓ | ✓ |
| User invite & role management | ✓ | ✓ | ✓ |
| Enterprise SSO (SAML / OIDC) | — | — | ✓ |
| Data export (full org snapshot) | ✓ | ✓ | ✓ |
| Retention policy + danger zone (Owner only) | ✓ | ✓ | ✓ |
| Admin seats included (people who log in) | 10 | 15 | 20 |
| Staff participants — report AI tools, sign policies, complete training (no seat needed) | Unlimited | Unlimited | Unlimited |
| Staff AI-tool reporting portal (anonymous shadow-AI intake) | ✓ | ✓ | ✓ |
| Support & Advisory | |||
| Email support | ✓ | ✓ | ✓ |
| Onboarding walkthrough | — | ✓ | ✓ |
| Priority support | — | — | ✓ |
| Advisory session (1:1 with the founder) | — | — | ✓ Included |
Agency / Enterprise includes one advisory session. Working sessions, half-day module training and a guided program launch are also available on their own, at published fees — see GOVERNBOX.ai Advisory Services →
Modular pricing
The more you add, the more you save
Every configuration includes AI Governance. Add Enterprise Risk, IT Inventory, and Data Management on top — each with its own scorecard, wizards, board-report chapter, and unlimited-signer attestations.
Configuration (all include AI)
Starter /yr
Pro /yr
Agency / Enterprise /yr
AI + 1 management module
$3,500
$12,000
—
Each additional module
+$1,750
+$5,000
—
AI + 2 management modules
$5,250
$17,000
—
Complete — AI + all three
$7,000
$19,900
$25,000
Monthly from $339/mo.
What each program adds
Five programs, one shared graph
AI Governance runs through all four management programs, which is why it is in every plan rather than sold beside them.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from StarterEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
AI Governance
In every plan
AI runs through all four — so it’s the foundation, not a fifth box.
AI Governance
In every plan
AI runs through all four below — it’s the foundation, not a fifth box.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from StarterEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
Every plan is built on AI Governance. You switch on the management modules — Risk, IT, Data — as you need them, and Privacy comes with every plan (the privacy program and a Privacy Policy from Starter; CCPA from Pro; GDPR and HIPAA on Agency). Price your configuration →
Price your configuration
Pick a tier, switch on the modules
Platform spine
Every tier · every module- ✓Its own readiness scorecard
- ✓Guided document wizards
- ✓A dedicated chapter in your quarterly Board Report
- ✓Unlimited-signer attestations
- ✓Admin Console, append-only audit log & two-step sign-in your organization can require
- ✓Shadow AI Discovery (browser extension) from Starter; Discovery+ (identity-provider / CASB imports, intake connector) from Pro
- ✓REST API with scoped keys (read from Starter, read + write from Pro); intake connector for Zapier, Jira and ServiceNow from Pro
- ✓Outbound webhooks — signed, retried — from Pro
Step 1 · Pick your depth
Starter — a real governance program
- ✦NIST AI RMF · ISO/IEC 42001 · all 43 dedicated U.S. state AI laws, plus specific statutes from 27 states (Colorado ADMT Act (SB 26-189), Colorado Chatbot Safety (HB 26-1263), Connecticut SB 5 (PA 26-15), Texas TRAIGA, California ADMT Regulations, Hawaii AI Acts (247 / 248), Alabama AI laws, Arizona AI laws, California AI laws (other statutes), Colorado AI laws (other statutes), Connecticut AI laws (other statutes), Delaware AI laws, Florida AI laws, Georgia AI laws, Idaho AI laws, Illinois AI law & guidance, Indiana AI laws, Iowa AI laws, Kansas AI laws, Kentucky AI laws, Louisiana AI laws, Maine AI laws, Maryland AI laws, Minnesota AI laws, Montana AI laws, Nebraska AI laws, Nevada AI laws, New Hampshire AI laws, New Jersey AI laws, New York AI laws, North Dakota AI laws, Oklahoma AI laws, Oregon AI laws, Rhode Island AI laws, South Carolina AI laws, Tennessee AI laws, Texas AI laws (other statutes), Utah AI laws, Vermont AI laws, Virginia AI laws, Washington AI laws, Wisconsin AI laws, Wyoming AI laws) · U.S. National (federal law & state landscape)
- ✦Risk register, impact assessments, incident log
- ✦Privacy program, privacy impact assessments & Privacy Policy
- ✦Full quarterly Board Report + Governance Badge
- ✦Word + PDF export
- ✦10 admin seats
- ✦Monthly payment option available
Step 2 · Switch on your modules
AI Governance
Foundation · in every plan
- ✓Free AI Readiness Scorecard + gap report
- ✓AI Use Case Log — inventory every AI tool, incl. shadow AI (EU AI Act prohibited-use screen on Agency)
- ✓Grounded document generation — 11 policy & plan types, every clause cited to a control · Patent pending
- ✓Vendor & AI System registries — approval status, terms on file, everything that depends on each
- ✓AI Risk Register + 7-section Impact Assessments
- ✓AI Incident Log — severity codes (EU AI Act Art. 73 flag on Agency)
- ✓AI Agents inventory — 12-item zero-trust checklist
- ✓AI Cost Tracking & Roll-Up — 60-day renewal alerts, board totals
- ✓Training Plan + Employee Attestations — unlimited signers
- ✓AI Project Management — Kanban + 7-phase lifecycle checklist
- ✓Compliance Crosswalks — NIST AI RMF · ISO/IEC 42001 · all 43 dedicated U.S. state AI laws, plus specific statutes from 27 states · U.S. National, on five shelves (Frameworks / United States / EU / Canada / Global); more by tier · Patent pending
- ✓Quarterly Board Report — maturity score + history
- ✓Governance Badge + public Trust Page
- ✓Regulatory “What’s Changing” feed · Patent pending
- ✓Org-wide risk register — 6 plain-language categories
- ✓Guided risk discovery — draft register in ~30 minutes
- ✓One-page risk appetite statement
- ✓Treatments & actions with named owners
- ✓Simple KRIs — green / amber / red
- ✓Quarterly board risk report chapter
- ✓Your AI risk register becomes the ‘technology & AI’ category
Tap to add IT Inventory & Mgmt and see what it includes.
Tap to add Data Management and see what it includes.
AI + 1 module
$3,500/yr
Billed annually · $339/mo
Nonprofit: $2,800/yr (20% off)
🤖 AI Governance (foundation)Included
AI + ⚠️ Enterprise Risk$3,500
Total / year$3,500
Continue to checkout →Every plan includes AI Governance, multi-tenant security & an audit log. Cancel anytime. Not legal advice.
Would rather not build it alone? GOVERNBOX.ai Advisory Services → publishes a fixed fee for every engagement, from a single working session to a guided program launch. Advisory is additive — the platform is designed to be run without it.
Coverage by plan
What’s covered on each plan
Each plan keeps everything below it and adds the frameworks listed. Free previews NIST AI RMF only. Every framework here is backed by controls in the library and verified on one of the crosswalk shelves (Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global).
Starter
Included on every paid plan:
- NIST AI RMF
- ISO/IEC 42001
- U.S. state AI laws (43 today — added as they pass)Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws. The U.S. state law landscape framework additionally cites specific statutes from 27 states.
- United States — federal law & state landscapeFederal legislation, executive orders and agency regulation, a cross-state view of AI disclosure and training-data laws. Per-state statutes — Illinois included — are the U.S. State AI Laws jurisdiction above.
Pro
Everything in Starter, plus:
- ISO/IEC 42005
- CCPA
- U.S. state privacy laws
- SOC 2 (Trust Services Criteria)
- New York DFS cybersecurity regulation (23 NYCRR 500)
- NAIC AI model bulletin (insurance)
- NAIC Insurance Data Security Model Law (#668)
- NIST SP 800-53 Rev. 5
- NIST Cybersecurity Framework (CSF) 2.0
- CanadaPIPEDA and provincial privacy law, the Directive on Automated Decision-Making, and the Canadian Human Rights Act as they apply to AI.
- AI frameworks, standards & healthcare guidelinesNIST profiles, ISO/IEC standards, IEEE, OECD and the healthcare AI reporting/assurance frameworks (FDA, WHO, CHAI, CONSORT-AI…).
Agency / Enterprise
Everything in Pro, plus:
- EU AI Act
- HIPAA
- GDPR
- Global privacy laws
- Europe — EU regulation, Italy, UK, Switzerland, NorwayEU regulation beyond the AI Act itself (GPAI code of practice, guidance), plus Italy's national AI law and the UK, Swiss and Norwegian frameworks. The EU AI Act and GDPR are not part of this unit — select each on its own under Laws & regulations below.
- Global — Americas, Middle East, Asia-Pacific, Central Asia & internationalTwenty further countries' AI laws and guidance plus the international instruments (Council of Europe, OECD, UNESCO, UN).
Jurisdictions (U.S. State Laws, U.S. National, Canada, AI Standards, Europe, Global) are each enabled as one unit on the Organization Profile; the standalone frameworks are chosen individually. New state laws are added as they pass. Not legal advice.
Where the tiers differ
Feature
Starter
Pro
Agency / Enterprise
NIST AI RMF · ISO/IEC 42001 · all U.S. state AI laws · U.S. National (federal law & the state landscape)
✓
✓
✓
Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws
✓
✓
✓
U.S. state law landscape — specific statutes from 27 states
✓
✓
✓
ISO/IEC 42005 · CCPA · U.S. state privacy laws · SOC 2 (Trust Services Criteria) · New York DFS cybersecurity regulation (23 NYCRR 500) · NAIC AI model bulletin (insurance) · NAIC Insurance Data Security Model Law (#668) · NIST SP 800-53 Rev. 5 · NIST Cybersecurity Framework (CSF) 2.0 · Canada · AI frameworks, standards & healthcare guidelines · NIST SP 800-53
—
✓
✓
EU AI Act · HIPAA · GDPR · Global privacy laws · Europe — EU regulation, Italy, UK, Switzerland, Norway · Global — Americas, Middle East, Asia-Pacific, Central Asia & international · OMB M-25-21/22
—
—
✓
Grounded document generation and the certified regulatory crosswalk · Patent pending
✓
✓
✓
Regulatory-change notifications ("What's Changing") · Patent pending
✓
✓
✓
Vendor and AI System registries
✓
✓
✓
REST API with scoped keys
Read
Read + write
Read + write
Outbound webhooks — signed, retried for a day
—
✓
✓
Intake connector — Zapier, Jira, ServiceNow, any webhook
—
✓
✓
Vendor questionnaires and the vendor portal
—
✓
✓
Use-case approval gate — an Admin signs off before a use case goes active
✓
✓
✓
Shadow AI Discovery — browser extension, staff AI-tool reporting link
✓
✓
✓
Shadow AI Discovery+ — identity-provider / CASB imports and the intake connector
—
✓
✓
AI Agent Analysis
—
✓
✓
Risk heat map · assessments auto-populate the register
—
✓
✓
AI projects running at once
Up to 2
Up to 5
Unlimited
Zero-trust agent checklist and scoring
—
—
✓
Document exports
Word + PDF
Branded
Branded
White-labeled Trust Page & badge
—
—
✓
Enterprise SSO (SAML / OIDC)
—
—
✓
Admin seats (people who log in)
10
15
20
Staff participants — report tools, sign policies, train
Unlimited
Unlimited
Unlimited
AI Training & Certification — all 7 AI Leadership Course credentials
✓
✓
✓
Support
Email
+ Onboarding
Priority + advisory
🏔️ On every plan
Colorado readiness, before the clock runs out
SB 26-189 and HB 26-1263 take effect January 1, 2027. Starter and up include a dedicated Colorado crosswalk, so the work is grounded well ahead of the deadline.
Not ready to pick a plan?
See where you stand with the free scorecard, or ask us anything first.